aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-07-04 05:29:38 -0400
committerJohan Hovold <johan@kernel.org>2018-07-04 09:40:54 -0400
commite33eab9ded328ccc14308afa51b5be7cbe78d30b (patch)
tree6bfa33296602bd3e3a1b72e1142c25b69fe1063a
parent021c91791a5e7e85c567452f1be3e4c2c6cb6063 (diff)
USB: serial: ch341: fix type promotion bug in ch341_control_in()
The "r" variable is an int and "bufsize" is an unsigned int so the comparison is type promoted to unsigned. If usb_control_msg() returns a negative that is treated as a high positive value and the error handling doesn't work. Fixes: 2d5a9c72d0c4 ("USB: serial: ch341: fix control-message error handling") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org>
-rw-r--r--drivers/usb/serial/ch341.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index bdd7a5ad3bf1..3bb1fff02bed 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -128,7 +128,7 @@ static int ch341_control_in(struct usb_device *dev,
128 r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request, 128 r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request,
129 USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, 129 USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
130 value, index, buf, bufsize, DEFAULT_TIMEOUT); 130 value, index, buf, bufsize, DEFAULT_TIMEOUT);
131 if (r < bufsize) { 131 if (r < (int)bufsize) {
132 if (r >= 0) { 132 if (r >= 0) {
133 dev_err(&dev->dev, 133 dev_err(&dev->dev,
134 "short control message received (%d < %u)\n", 134 "short control message received (%d < %u)\n",